3 ms·

Is that actually true? How would outside traffic get through a NAT?

by vpzom 7y ago

paulddraper 7y ago
Outside traffic gets through a NAT all the time. Including HN, moments before reading this page. It's true that outside networks usually cannot send a TCP SYN to your local network without IP spoofing or other hackery. But a firewall is sufficient; there is no need for network address translation.
zajio1am 7y ago
NAT is not a barrier for traffic, so question 'how traffic get through a NAT' does not make sense. Router by default forwards packets. NAT just means that in some cases it also translates src/dst addresses of packets. If you have a router with NAT and without (stateful) firewall or RPF, and such router receives a packet on wan port with dst address from your private LAN range, then such packet is just passed to your LAN (as NAT does not apply here). Obviously, such packet is unroutable on general Internet, but could be send by our ISP or by other customers of your ISP if they are on the same network (e.g. wifi AP) as your wan port. There are also more sophisticated ways, like abusing automatic decapsulation of packets (if enabled). Fortunately, in most cases a router with NAT also has enabled stateful firewall, so this is moot.
- umanwizard 7y ago
  > Obviously, such packet is unroutable on general Internet You buried the lede here. This makes a huge difference. I am much more willing to trust my ISP (a major company who would be quickly found out if they were trying to hack random people) than the entire set of people on the global internet.
zAy0LfpBZLC8mAC 7y ago
It doesn't have to get "through NAT", that's not how NAT works. NAT is an address remapping function that can be configured to happen for some particular packets and has nothing to do with the forwarding function/routing that is completely orthogonal to it. Typically, NAT on home routers would be configured to remap the source address of packets coming from the LAN interface destined to the WAN interface as well as any packets in the opposite direction that match flows that were remapped in the outbound direction. If someone (your ISP, someone who compromised your ISP's router, someone who happens to be your neighbour on an ISP with misconfigured routers ...) sends a packets directly addressed to your internal address range to your WAN interface, that is of no interest to the NAT function and will simply be routed to the LAN interface unchanged. That is: Unless the device happens to also have a stateful firewall that would prevent that. But then, the firewall would work just as well without NAT.
- deleted 7y ago
  [deleted]

Is that actually true? How would outside traffic get through a NAT?

by vpzom 7y ago

Is that actually true? How would outside traffic get through a NAT?

Outside traffic gets through a NAT all the time. Including HN, moments before reading this page. It's true that outside networks usually cannot send a TCP SYN to your local network without IP spoofing or other hackery. But a firewall is sufficient; there is no need for network address translation.

zajio1am 7y ago

NAT is not a barrier for traffic, so question 'how traffic get through a NAT' does not make sense. Router by default forwards packets. NAT just means that in some cases it also translates src/dst addresses of packets. If you have a router with NAT and without (stateful) firewall or RPF, and such router receives a packet on wan port with dst address from your private LAN range, then such packet is just passed to your LAN (as NAT does not apply here). Obviously, such packet is unroutable on general Internet, but could be send by our ISP or by other customers of your ISP if they are on the same network (e.g. wifi AP) as your wan port. There are also more sophisticated ways, like abusing automatic decapsulation of packets (if enabled). Fortunately, in most cases a router with NAT also has enabled stateful firewall, so this is moot.

umanwizard 7y ago
> Obviously, such packet is unroutable on general Internet You buried the lede here. This makes a huge difference. I am much more willing to trust my ISP (a major company who would be quickly found out if they were trying to hack random people) than the entire set of people on the global internet.

zAy0LfpBZLC8mAC 7y ago

It doesn't have to get "through NAT", that's not how NAT works. NAT is an address remapping function that can be configured to happen for some particular packets and has nothing to do with the forwarding function/routing that is completely orthogonal to it. Typically, NAT on home routers would be configured to remap the source address of packets coming from the LAN interface destined to the WAN interface as well as any packets in the opposite direction that match flows that were remapped in the outbound direction. If someone (your ISP, someone who compromised your ISP's router, someone who happens to be your neighbour on an ISP with misconfigured routers ...) sends a packets directly addressed to your internal address range to your WAN interface, that is of no interest to the NAT function and will simply be routed to the LAN interface unchanged. That is: Unless the device happens to also have a stateful firewall that would prevent that. But then, the firewall would work just as well without NAT.

deleted 7y ago
[deleted]